This glossary collects the essential definitions of the main free and open source software licences, as well as related concepts such as source code escrow, contributor agreements and SBOM standards. Sources include the original text of each licence and applicable European and Spanish law.
FOSS (Free and Open Source Software)
Acronym encompassing two related but differently emphasised movements: free software (FSF), which emphasises four essential user freedoms (to use, study, modify and distribute, including modifications); and open source (OSI), which emphasises the practical advantages of collaborative development and the 10 criteria of the OSI definition. The vast majority of software under OSI-approved licences also satisfies the FSF criteria. The use of FOSS components in commercial products and AI systems requires a formal software composition analysis (SCA) process to avoid proprietary code contamination and to comply with the obligations of each licence.
MIT Licence
One of the most permissive and widely used software licences, originating at the Massachusetts Institute of Technology. Permits use, copying, modification, merging, publishing, distribution, sublicensing and sale of copies of the software (including in proprietary products), subject only to the condition of including the copyright notice and permission notice in all copies or substantial portions of the software. Imposes no copyleft obligations: modified code may be distributed under any licence, including proprietary licences. SPDX Identifier: MIT. Compatible with virtually all other FOSS licences.
GNU GPL v2 and v3 (General Public Licence)
The GNU General Public Licence (GPL) is the most widely used strong-copyleft licence, created by the Free Software Foundation (FSF). Guarantees the four software freedoms subject to a copyleft obligation: all derivative software or software incorporating GPL code must be distributed under the same GPL licence, with access to the complete source code. GPL v2 (1991) and GPL v3 (2007) are mutually incompatible unless the software is licensed "v2 or later". GPL v3 adds: anti-tivoisation clause (prohibits hardware locks preventing modifications), anti-DRM clause, explicit patent grant and improved compatibility with other licences.
GNU LGPL (Lesser General Public Licence)
A weak-copyleft licence designed primarily for software libraries. Unlike the GPL, it allows proprietary or closed-source applications to dynamically link against the LGPL library without being required to publish their own source code, provided that modifications made to the LGPL library itself are distributed under the LGPL. The preferred choice for general-purpose libraries intended to be accessible to commercial projects without imposing strong copyleft. Available in versions v2.1 and v3.
GNU AGPL (Affero General Public Licence)
A variant of GPL v3 created to close the "SaaS loophole" or "network gap": the standard GPL does not require source code disclosure when software is run on a server and accessed remotely over a network (cloud/SaaS model), as the software is technically not "distributed". AGPL v3 adds the obligation to provide the complete source code to any user who accesses the software over a network. Particularly relevant for web software, APIs and cloud services. Using AGPL components in a SaaS product may require publishing the entire application codebase.
Apache Licence 2.0
A permissive free software licence created by the Apache Software Foundation (ASF), widely used in AI projects. Permits use, modification and distribution (including in proprietary products) with few conditions: include the copyright notice, reproduce the full licence text in redistributed copies, and document changes made. Includes an explicit patent licence grant that protects users and distributors against patent claims from contributors. Compatible with GPL v3 but not with GPL v2.
BSD Licence (2-Clause and 3-Clause)
A family of permissive licences originating at the University of California, Berkeley. The 2-Clause BSD (Simplified/FreeBSD Licence) requires only: (1) retaining the copyright notice and permission notice in source and binary redistributions. The 3-Clause BSD (New/Revised/Modified BSD Licence) adds a non-endorsement clause prohibiting use of the organisation's or contributors' names to endorse or promote derived products without written permission. Both are permissive, compatible with GPL v3 and impose no copyleft. Widely used in networking, operating systems (FreeBSD, OpenBSD) and university research projects.
Mozilla Public Licence 2.0 (MPL 2.0)
A file-level weak-copyleft licence created by the Mozilla Foundation. Allows combining MPL-covered code with proprietary or differently licensed code in the same project, provided that the files originally covered by the MPL and any modifications to them remain under the MPL with accessible source code. A middle ground between permissive licences (MIT, Apache) and strong copyleft (GPL). Compatible with GPL v2 and v3 (under specific conditions). Includes an explicit patent licence grant. Used in Firefox, several Mozilla projects and various open source tools.
Creative Commons CC0 (Public Domain Dedication)
A legal tool created by Creative Commons enabling creators to waive all their intellectual property rights over a work to the greatest extent permitted by applicable law, effectively placing it in the public domain. Where a complete waiver is not legally possible (some jurisdictions do not allow waiver of moral rights), CC0 operates as a licence granting completely unrestricted use. Widely used for open data, scientific datasets and AI training datasets to maximise reuse without attribution requirements. SPDX Identifier: CC0-1.0.
Creative Commons BY (CC BY 4.0)
The most permissive of the six standard CC licences. Permits copying, distribution, display, performance and transformation of the work, even for commercial purposes, subject only to the condition of giving appropriate credit to the author (name, work, licence, changes made). Imposes no restrictions on the licence of derivative works (the licensee may publish them under any licence). The standard licence for most scientific open-access publications and compatible with open science and open government data.
Creative Commons BY-SA (CC BY-SA 4.0)
A CC licence that combines mandatory attribution (BY) with a ShareAlike (SA) condition: derivative works must be distributed under the same CC BY-SA licence or a compatible licence, making it the copyleft licence of the Creative Commons ecosystem. The licence of Wikipedia, Wikimedia Commons and OpenStreetMap. Version 4.0 declares compatibility with GNU GPL v3 (under specific conditions), allowing CC BY-SA material to be incorporated into GPL projects and vice versa. Not compatible with CC BY-NC-SA or CC BY-ND.
Creative Commons BY-NC (CC BY-NC 4.0)
A CC licence permitting copying, distribution and creation of derivative works for non-commercial purposes only (NC, Non-Commercial), provided credit is given to the author (BY). Commercial use requires separate authorisation from the rights holder. The definition of "commercial use" can generate disputes: it encompasses any activity primarily intended for commercial advantage or monetary compensation. Derivative works may be distributed under any non-commercial licence. Not compatible with the GPL or most open source licences.
Proprietary / Commercial licence
A software licence in which the rights holder (licensor) grants the end user (licensee) the right to use the software under specific, restrictive conditions: no access to source code, no right to modify, copy or redistribute, non-transferable, and limited to a specified number of installations and a specified term. Terms are set out in an EULA. Contrasts with the FOSS model in that the user has no freedom to study, modify or distribute the software. In the SaaS model, access is governed by Terms of Service (ToS) or a Master Service Agreement (MSA/SLA) rather than a traditional software licence.
Dual licensing
A software commercialisation strategy in which the developer distributes the same product under two different licences simultaneously: (1) an open source licence, typically strong copyleft (GPL, AGPL), for the open source community; and (2) a commercial/proprietary licence for businesses that need to integrate the software into proprietary products without complying with copyleft obligations. Only the holder of all copyright rights can offer dual licensing (requires assignment CLAs from all contributors). Notable examples: MySQL (GPL + Oracle Commercial Licence), Qt Framework (GPL + Commercial), MongoDB (SSPL + Commercial).
EULA (End User Licence Agreement)
A contract between the software IP rights holder (licensor) and the end user (licensee), setting out the conditions of use: number of devices on which the software may be installed, prohibition of reverse engineering, manufacturer liability limitations, termination conditions, etc. Unlike FOSS licences, an EULA does not grant access to source code or rights to modify or redistribute the software. Acceptance is typically effected by clicking an acceptance button ("clickwrap") or by merely using the software ("browsewrap"). The validity and enforceability of EULAs varies by jurisdiction, particularly regarding unfair terms in consumer contracts.
CLA (Contributor Licence Agreement)
A legal agreement between the maintainer of a software project (company or foundation) and each external contributor, by which the contributor assigns or licences to the maintainer the rights over their code contributions. Two types: assignment CLA (the contributor transfers ownership, enabling the maintainer to relicense the project in the future) and licence CLA (the contributor grants a broad licence while retaining ownership). Essential in corporate open source projects for legal defence and to preserve dual licensing capability. Management tool: CLA Assistant (GitHub). Reference templates: Apache ICLA/CCLA, Google CLA.
Source code escrow (Software escrow)
A tripartite agreement between a proprietary software licensor (vendor/developer), the licensee (client) and a neutral custodian agent (escrow agent), under which the source code, technical documentation, build scripts and other software materials are held in secure custody, to be released to the licensee upon the occurrence of specified release events (trigger events) contractually defined: insolvency or bankruptcy of the licensor, cessation of maintenance or support, material breach of SLAs, or a merger/acquisition adversely affecting service continuity. An essential technology risk management instrument in contracts for business-critical software (fintech, healthcare, industry, public sector). Specialist escrow agents (NCC Group, Escrow London, Iron Mountain) offer periodic deposit verification services.
Open Core model
A software business model in which the developer publishes the functional core of the product under an open source licence (typically permissive or weak copyleft), while keeping advanced features, enterprise plugins, integrations or security modules under a proprietary or commercial licence. Enables broad adoption by the open source community while monetising through premium functionality for enterprise customers. Well-known examples: GitLab (MIT core + EE Proprietary), Elastic (Apache 2.0 core + Elastic Licence 2.0), HashiCorp Vault (MPL core + BSL). Requires careful management of the boundary between open and proprietary components to avoid licence conflicts.
Licence compatibility
The property of two or more licences that allows software under those licences to be combined, linked or redistributed in a single product or distribution without violating any of them. Particularly critical when combining components with copyleft (GPL, AGPL) with permissive components (MIT, Apache) or with proprietary code. General rule: permissive licences are mutually compatible; strong copyleft licences (GPL) are only compatible with a subset of other licences. The FSF publishes a licence compatibility table. Licence compatibility analysis is part of the Software Composition Analysis (SCA) process, mandatory in IP audits for M&A transactions and investment rounds.
SPDX and SBOM (Software Bill of Materials)
SPDX (Software Package Data Exchange) is the Linux Foundation standard for communicating in machine-readable format the licence metadata, copyright information and component data associated with software packages. It defines short, unique identifiers for each known licence (SPDX identifiers: "MIT", "Apache-2.0", "GPL-3.0-only", etc.) used in SBOM (Software Bill of Materials) files. SBOMs are increasingly required by regulation (US Executive Order 14028 on software security, 2021; EU Cyber Resilience Act, adopted 2024, applying from 2027) and by investors and enterprise customers in the context of software supply chain risk management (supply chain security).
